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Abstract — The objective of this work is the 
implementation of a new IT governance platform 
adaptable to any type of Information system architecture 
and any kind of business. The proposed platform is 
intelligent and independent to understand the business 
needs continuously changing, is distributed to involve all 
stakeholders and heterogeneous components, and scalable 
to accumulate the know-how of the company's IT 
Governance through a learning asset. 
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I. INTRODUCTION 

Information systems (IS) have known exponential growth 
both in terms of architectural complexity and in terms of 
data processed size. The history of the discipline is more 
than 30 years during which IS issues’ varied from 
modeling and development concerns of the technical 
solution to management challenge. Indeed, in the early 
80s, the information system was a computer application 
for which was interested in development methodology and 
techniques used [10], later we attached importance to the 
theory of production with cumulative restatement of issues 
order (references, work techniques, assembling knowledge 
... etc.). From the 90s case studies about Information 
systems took place [10] to focus on the weaknesses and 
strengths of each type and the operations supported and 
development. A variety of research topic has opened in the 
years after, namely the appearance of organization 
management, collaborative aspect, the use of internet and 
new technologies adaptation in general. 

To this end, companies have adopted solutions such as the 
use of ERP, outsourcing [9] or even Information System 
redesign and development project with advanced 
technology. The results were not always positive: 

• Outsourcing: Sustainable and high costs, non-strategic 
and managerial decisions and contract cancellation serious 
consequences. [17] 

ERP: exceeding the time and cost of implementation, 
impact on work procedures, change for end users. 

• IS redesigned with new technologies such as services 
oriented architectures a reflection on all the company's 


services is essential correlation with the return on 
investment. 

A constructive and thorough study of Top Management in 
collaboration with the Information Systems Department 
and its potential users is needed, not only before the 
project but throughout the production of IS. This is called 
information Systems Governance." 

Experts in this field have implemented born repositories 
for collecting good practices and their generalization such 
as COBIT, ITIL, CMMI, and IS027001 ... etc. These 
standards are designed to align the governance of 
information systems through a set of guidelines that serve 
as benchmarks to business processes. Measuring scales are 
also defined for the listeners to evaluate the IS maturity. 
However these frameworks are extensive documentation 
that requires an implementation and realization on the part 
of managers and crafts. 

We present in this paper IS governance platform to realize 
continuously and intelligently best practices 
implementation for a IS of any type and any size. 

The solution is based on: 

• Inter-organization Workflow with multi-agent 
systems to interconnect the various 
components of the SI, 

• Mediation Expert System between real 
businesses needs and references. 

• Semantic Engine to interpret the different 
demands of users to an IT Governance jargon. 

The article is structured as following: After the 
introduction we talk about IT Governance (ITG) 
implementation problems after that we present a state of 
art of Multi-Agent system. Inter-organizational workflows 
and semantic web, in the fourth part we present the 
proposed architecture and its components description. We 
finally present perspectives and conclusion. 

IT Governance implementation problem 
Information System (IS) main mission is the treatment of 
business activity through information technology and 
verification of their compliance with its business and its 
needs. 

To check the alignment of the IS and business strategy, we 
must have recourse to IT Governance (GSI). 
In practical terms, the answer to these questions is via 
standards that address monitoring standards such as 
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COBIT and COSO and implementation of good practices 
such as ITIL and CMMI. 

There are many other IT Governance frameworks 
COBIT (Control Objectives for Information and related 
Technology Business), developed in 1994 (published in 
1996) by ISACA (The Information System Audit and 
Control Association) is an IT governance tool that has 
been designed for the control objectives of information 
technology. It’s a framework of information systems 
governance that breaks any IS on 34 processes, which are 
divided into four functional areas: 

•S Planning and Organization) (10 processes). 

•S Acquire and Implement) (7 processes). 

•S Deliver and Support) (13 processes). 

•S Monitor (4 processes). 

These four areas can cover 318 goals. 


Table. l. The most used IT GRC platforms 


SOLUTION 

ADVANTAGES 

Agiliance RiskVision 

Governance Management and 
Analysis 

financial services 

Public-health, 

TruComply 

Automating Governance 

business processes 

ControlCase GRC 

GRC 

Asset Management 

Vulnerability analysis 

Easy2Comply 

GRC 

Engine risk for analyzes 
complex statistics 

Modulo Risk 

Manager NG 

Improving the overall 

governance of the company, 
public sector 

Company Financials 

RSA Archer eGRC 

Platform 

GRC 

Gestion de contenu, 

Gestion des risques 

Controle, de workflow de 
gestion 

Rsam 

assistance and tools 

(predisposed for industries) 

Symantec Control 

Compliance Suite 

(CCS) 

GRC Management and 

Analysis, 

Risk quantification methods 
based on data (levels of 
vulnerability, criticality of 
assets and control functions) 
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Table. 2: IT GRC solutions advantages 


Editor 

Solution name 

Version 

Agiliance 

Agiliance RiskVision 
V6.0 

V 6.0 

ANXeBusiness 

ControlCase GRC V4.0 

V4.0 

ControlCase 

TruComply V6 

V6 

Easy2Comply 

Easy2Comply V 4.7.5 

V4.7.5 

Modulo 

Modulo Risk 

Manager NG 

V7.2 

RSA Archer 

RSA Archer eGRC 

Platform V 5.0.6 

V5.0.6 

Rsam 

Rsam V 7.2 

V7.2 

Symantec 

Symantec Control 
Compliance Suite 

(CCS) V 10.5 

V10.5 


However there frameworks aren’t the only need, there is 
always a problem of the ITG implementation, which 
depends on several factors including: organizational 
culture and structure, strategy, size, regional differences, 
maturity, ethics and trust. 

For this reason, big software editors have marketed 
Governance solutions for businesses: The most common 
Governance solutions in the market are [6]: 

We carried out the following comparison: 

A linear reading of this test and the measurement of the 
effectiveness of these solutions relative to IT Governance ( 
ITG) dependency factors can deduce that: 

• The solutions marketed by major publishers show a 
discrepancy in relation to the implementation of the 
ITG in SI of various companies (size, turnover, type, 
maturity, location etc ...) 

• The majority of these solutions are ERP modules 
working only with the rest of the suite. 

• High Cost of implementation with a risk of 
inefficiency 

• .Need for external advice. 

• They do not concern all IS stakeholders and all areas 
of the business at a time. 

To remedy these limitations and to address the lack of 
architecture with theoretical basis we proposed this work. 
The proposed architecture is based on many theoretical 
foundations: Inter-organizational Workflows, Multi-agent 
systems [8]. and semantic web. 

II. STAT OF ART 

A. Multi-Agent System 

There is no unified definition of an Agent but the closest to 
our vision is: An agent is an autonomous real or abstract 
entity that is capable of acting on itself and its 
environment, which, in a multi-agent world, can 
communicate with other agents, and whose behavior is the 
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result of observations, knowledge and interactions with 
other agents [2]. 

In this case, not only one agent is used but a set of agents 
witch interact among each other that are called Multi-agent 
system (MAS). 

MAS is characterized by: 

N Every agent in the system has his own 
knowledge and way to resolve problems. 

N There is no global control of an MAS, 

N The Data in MAS is decentralized. 

As for MAS Communication is a particular form of action 
that affects the mental representations of agents to make 
changes in the environment. It must also be modeled as an 
act that could affect the status of other agents. 

There are two kinds of Communication procedures: 

N Information sharing: it is historically the first 
model, where shared memory is seen as a 
table on which agents write and find partial 
answers and information. 

N Sending messages: proposed by Hewitt [5] 
actor model defining an actor as an active 
and autonomous entity that has a partial view 
of the universe. 

This actor is characterized by: acquaintances and 
behavior described by a script (set of methods that 
indicate the various actions that can accomplish this 
actor in response to the messages it receives). 

B. Inter-organizational Workflow 
A workflow in general is the total or partial automation of 
business process execution, during which documents, 
information tasks from one participant to another to 
perform specific activities according to predefined rules. 
There are many kinds of workflows [3] namely: 
•Administration Workflow: devoted to manage 
administrative procedures whose rules of conducts are 
established and known by everyone in the company. 
•Production Workflow: devoted to manage the 
production process in the company. 

•Collaboration Workflow: devoted to manage awareness 
and group collaboration in a project of creative work 
•Ad-hoc Workflow: is a class of workflows for specific 
situations where the flow logic to be followed is set during 
execution. It forms a hybrid solution collecting 
characteristics administration, production, and 
collaboration 

The interested on these kinds of Workflow will find in the 
references more details about them the advantages and 
drawbacks of every one. 

•Inter-organizational Workflow (IOW): is an extension 
of the classical Workflow aiming at cooperating between 
heterogeneous and autonomous organizations. It is the 
reason why we choose it as a workflow model for this IT 
Governance solution. 


B. Multi-agents systems 

Multi-agent systems are widely used for modeling 
coordination system [8], It seems to be appropriate to 
describe the coordination of IOW as a dynamic system 
aiming at finding “supply and demand service” and 
adopting the negotiation between partners. In fact, agent 
technology is a custom frame for IOW abstraction: it 
resolves its constraint of distribution, heterogeneity, 
autonomy and flexibility: 

• Autonomy: every organization of the IOW can be 
encapsulated in an Agent an autonomous entity having 
its intentions goals and resources and able to be executed 
alone or in an environment, depending on the context. 

• Distribution: IOW is a distributed context and MAS 
includes specific architecture, communication protocols 
and languages to support this constraint. 

• Heterogeneity: Agent technology allows communication 
and interaction between heterogonous agents through 
Agent-Communication-Languages ( ACL) . 

It also provides synchronous and asynchronous ways of 
communication depending on the agent localization and 
constraints. 

MAS offer many Meta-Models to cover the organizational 
aspect of Workflow. It also covers the scalability and 
security worries in loose IOW context. 

As for the semantic Web which is the collaborative 
movement of W3C providing a model that allows data to 
be shared and reused across applications, enterprises and 
groups of users It helps to represent shared business 
terminology of the IOW in a formal way to solve semantic 
conflicts in the one hand and to define properly services ( 
supply and demand) in the other hand [2] 

The best representation of semantic web on MAS context 
is the use of ontology recognized in communication 
protocol of agents. 

C. Semantic Web and Ontologies 

Ontology is a semantic source which includes or implies a 
certain view of the world with respect to a given domain; 
this view is often designed as a set of concepts such as 
entities, attributes, processes... etc. 

It can take different forms but it necessarily includes a 
vocabulary of terms and specification of their meaning. 

As for Ontology types, there namely five: 

• Task ontology: vocabulary linked to special task or 
activity. Method ontology: the role played by each 
concept in the argument is made explicit. 

• Application ontology or task and domain ontology: 
write concepts depending on both of a domain and a 
particular task, which are often two specializations of the 
related Ontologies. 

• Generic ontology: describe very general concepts such 
as space, time, matter, objects, events, actions, etc., 
which are independent of a problem or a particular area 
of application. 
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• Domain ontology: vocabulary linked to a generic 
domain by specifying the concepts presented in Generic 
ontology: electronic, automobile. 

Proposed architecture 

A. . Introduction 

Faced to a competitive market continuously changing IT 
solutions, and information systems are made of 
heterogeneous components with various information flows 
and processes increasingly complex. The decision of top 
management in the field of IT Governance became 
sensitive (poor visibility) Hence the need of adequate IT 
governance tools. 

In this perspective, this research focuses on modeling IT 
governance solution for enterprise with different business 
flow and heterogeneous partners assisting the Information 
system process orchestration. 

B. Functionality and Benefits of the solution 

The objective of this work is to propose a workflow model 
that encompasses IT Governance support on good 
practices (we opted for the COBIT) and adaptability to the 
complexity and changes with agile appearance, distributed 
and cooperative through a workflow-based on multi-agent 
systems (MAS). 

The proposed architecture is a process oriented solution 
that enables: 

-Strategic analysis of an information system through the 
Inter-organizational Workflow. 

-Exploit the strengths of COBIT for Information Systems 
Governance namely: 

->List the computer activities to implement 
-^Propose any previous optimization and control 
activities (agents Learning COBIT). 

->Deduce the different levels of maturity, measures and 
performance indicators to be used 
->Defme the responsibility matrix. 

-^Provide adequate control tests 

-Distribution, autonomy and learning through MAS. 
-Semantic efficiency and portability on the web through 
the AuditOntology. 

In addition, this solution is intended for all users of the IS 
for a self-audit in real time by combining the raw material 
of the COBIT framework and know-how of the company. 

C. Generic Architecture 

The architecture of the loose Inter-Organizational 
Workflow (IOW) of IT Governance is a solution that 
allows real-time governance of each IS component without 
consideration of its technical characteristics and its 
interconnection with the rest of the components. It is based 
on multi-agent systems and COBIT framework in version 
4.1 it contains: 


-IS Workflow Agents: Each agent represents an IS 
business application not necessarily communicate with 
each other 



Fig.l: Generic architecture 


-Business objective entity/ IT Process entity / IT goal 
entity: There are three classes of entities managed by 
COBIT Agent: Business objective entity manages a set of 
IT goals entities that appeal in its turn to IT processes 
entities. 

-IS Manager Agent: the agent who managed IS Workflow 
agents (creation / suspension / resource sharing) 
-COBIT Manager Agent: the Agent who manages COBIT 
Agents (creation / suspension / resource sharing) 
-Connection Server Agents: Yellow Page for the 
publication of responses and requests respectively COBIT 
agents and IS Workflow Agents. 

-Mediator Agent: establishes the correspondence between 
demand of IS Workflow Agents and supply of COBIT 
Agent. 

D. Agents Description 

Dl. Matchmaker 

In literature, there are mainly three types of mediator 
agents [3] "Matchmaker," "Broker" and "Facilitator" The 
difference between a "Matchmaker" and "Facilitator" is 
that the matchmaker allows exchanging the identities of 
the applicant and the supplier, then both parties 
communicate directly. The facilitator is an intermediate 
transaction. As for a "Broker" it has delegated services to 
the preferences of the applicant then asks the supplier of 
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results and directly sends the result to the applicant. 
In our case, a Matchmaker agent is the best choice to 
connect COBIT Agent with IS Workflow Agent and 
information about query is exchanged directly between 
the two agents without a third part implication. This 
allows to simulate real audit operation based on user 
interviews and to propose practical recommendations. 

So the role of the mediator is to find the best COBIT 
agent or agents for IS Workflow agent. 

One agent to perform the platform mediation is not enough 
insofar as several functionalities are needed in addition to 
the demanded task parallelism. Indeed, we propose 
mediation architecture that raises three features: requests 
and offers persistent, semantic interpretation and requests 
and offers matchmaking. These three tasks in practical 
terms exceed the capabilities of a cognitive agent. 
Especially in matchmaking knowledge base consulting is 
required to match the best offers on demand. Hence the 
idea to replace the mediator agent by a mediation expert 
system with a semantic inference engine and the publisher 
is the persistence entity 


Matchmaker 



Fig. 2: Matchmaker Multi-Agent System 


D2. IS Workflow Agent 

1. In the foregoing, the IS Workflow Agent has been 
described as a reactive agent which communicates with 
the IS component by an interface to encapsulate the 
request from the user and transmit it to the IS 
connection server. Technically this function was 
implemented by a direct display of the user query. The 
agent triggers and sends this message to the server. In 
the literature of interfaces agents [17], a reference 
structure is required to optimize the internal structure 
of the agent and to make its scalability possible: In fact, 
the agent has an input interface and an output 
processing, interconnected to each other with 
possibility of return of the output to the input: 

2. An architecture of IS Workflow agent was therefore 
proposed based on this reference structure and adapted 
to its functionality in the global architecture which is 
the encapsulation of the IS business objectives 


submitted by the user about an IS component given and 
published in the IS Connection server . 


Agent Workflow SI 




Vll€ 

O _ . 

Processing 

o 

Service Factory 


Fig. 3 IS Workflow Agent Architecture 


The IS Workflow Agent contains three parts: 

View: it is the interface of client request expression for an 
IS component that is launched from the global interface 
when the user evokes the component in question. 
Processing: it is the layer responsible for the reformulation 
of the customer request in the form of requests processed 
in the platform by capturing the different variants of the 
system (date, identity of the applicant, status, priority... 
etc.). 

Service Factory: it is the layer responsible of the service 
creation and circulation in the platform. 

D3. Agent 

3. Among the advantages of the proposed architecture is 
based on both COBIT framework and Organization 
context: Although COBIT is a leading standard of IS 
governance, however implementation depends on the 
company's maturity to get a closer context and more 
efficient platform. In fact, we proposed a reference layer 
having a COBIT core for its power in structuring and its 
strengths in ITG, to which we added other business 
objectives, other IT processes and other metrics by 
updating the repository (new version of COBIT or merger 
with other repositories of strategic level) or creating new 
objectives and IT processes from the expertise of the 
company proposed by the information systems 
management. To realize this aspect, COBIT agents were 
replaced by Framework agents. Manager agent is replaced 
by MAS of 3 agents namely: -Manager Agent: the agent 
who manages the businesses Objective agents. 

-Update Agent: the agent responsible for the framework 
update: we should remind that in the iteration i=0, we 
have COBIT framework in its version 4.1. 

-Learning Agent: the agent who learns and logs demands 
(requests) treaties to enrich the core with IS Management 
addition capability of Objectives and processes. 

As far as semantic matchmaking is concerned, we devoted 
part of the work to study IT Governance Ontologies in 
order to afford a performance semantic inference engine to 
the platform [15]. Let’s resume the important results: 

There is no ontology specific to IT Governance, but many 
modeling works were done to computerize existing 
frameworks. We proposed a building model of IT 
Governance Ontologies based on conceptual models and 
by using the ontology building method 
“METHONOTOLGY” [15]. We applied this model to 
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construct “AuditOntology” used in the 3 ld version of the 
architecture. 

The main role of this ontology is to understand users’ 
requests in an IT Governance way. It’s consumed in the 
matchmaker expert system to ensure correspondence 
between IS Business Goals and Framework Business 
Goals. 

The architecture is service oriented: In fact, the request and 
response form is a service describing the particularity of 
the IT Governance matters such as: IT active, user, date, 
business goal, priority, perspective, target, action. 

m. SIMULATION 

A. General Presentation 

As described before, the proposed architecture aims at 
ensuring IT Governance of a Complex Information 
System. It is based on three essential components namely: 

1. Loose Inter-organizational Workflow of ITG 

2. Matchmaking Expert system with semantic inference 
engine 

3. IT Governance Framework Multi -Agent system 

To implement this architecture we proposed a web solution 
multi-users linked to a knowledge base, intelligent agents 
are deployed to: 

• Capture uses needs 

• Interpret their requests to ITG understood goals 

• Propose convenient IT Processes from ITG 
framework to users’ requests. 

• Update the used framework 

To evaluate the platform results we compare them to ITG 
expert ones for the same request, since one of the main 
objectives of this research work is to computerize ITG 
audit mission. 

B. Technical presentation 

The proposed platform is a web solution developed in Java 
using the J2EE Technology with Frameworks JPA, EJB, 
JSF2.2 and MySQL database Management system As for 
multi-agent systems we used Madkit 5 API 
As for semantic analysis we used the Solr server version 
As for ontology we used OWL-S language in the editor 
Protege 4.3 and Fact ++ compiler. 

As for AuditOntology development, there are many 
implementation steps such as entities and classes creation, 
objects properties and data properties creation, 
annotations. The compilation is done through Fact ++ 

As for the Semantic server to analyze the ontology used in 
the web application, the choice of Solr sever is due to its 
efficiency as far as semantic analysis is concerned it’s API 
also supports languages specificities to deal with 
synonyms, tenses and linking words. 

C. Functional presentation 

As presented before, the platform main functionalities’ are: 
♦> Static configuration 
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♦> Dynamic request creation 
♦> Results visualization with details 
♦> Report edition 
♦> System logging 
♦> EAS IT-GRC launching 

IV. CONCLUSION AND PERSPECTIVES 

As conclusion the purpose of this paper is to deploy an IT 
Strategic platform to provide permanent and interactive 
Governance of Information systems. 

Many literature issues were invoked namely: 
Inter-Organizational Workflows 
Multi-agent System and artificial intelligence 
Mediation Expert system 
Semantic Web and Ontologies 
The choice of every issue has an added value for this 
solution; in fact. Inter-organization Workflows provide the 
orchestration of heterogeneous components of an IS in an 
autonomic way. 

Multi-agent system insures the intelligent dimension of the 
solution with high level communication protocol and 
modeling architecture. Mediation in MAS gives a 
theoretical model of matching services among intelligent 
entities. 

Ontologies offer the semantic alignment of stakeholders 
with IT Governance vocabulary 

This paper presents the evolution of the proposed solution 
and also its integration to the global Architecture EAS IT- 
GRC 

In fact, the IT Governance IOW role is not only to find the 
convenient Business Objectives for user demands but to 
find the best IT processes to launch with efficient priority 
order. It’s why this work perspective will be the 
amelioration of priority calculation to get the same results 
as the expert’s estimations. 

REFERENCES 

[1] Alavi, M„ & Carlson, P. (1992). A review of MIS 
research and disciplinary development. Journal of 
Management Information Systems, 45-62. 

[2] Chergui Meriyem, Sayouti Adil, Medromi 

Hicham. "IT Governance Ontology Building Process : 
Example of developing Audit 

Ontology ".International Journal of Computer 
Techniques (IJCT) V2(l): Page(134-141) Jan-Feb 
2015. ISSN: 2394-2231. Published by International 
Research Group-IR 

[3] A. SAYOUTI, H. MEDROMI -“Les Systemes 
Multi-Agents : Application au Controle sur Internet” 
Auteurs Editions universitaires europeennes, Aout 
2012 . 

[4] Sayouti, A., Qrichi Aniba, F., & Madromi, H. (2008, 
November). Interactions between agents as shared 
resources in multi-agents systems. In New 


www.ijaers.com 


Page 1 146 


International Journal of Advanced Engineering Research and Science (IJAERS) 
https://dx.doi. ors/1 0.221 61/ijaers/3. 12.28 


[Vol-3, Issue-12, Dec- 2016] 
ISSN: 2349-6495(P) 1 2456-1908(0) 


Technologies, Mobility and Security, 2008. NTMS'08. 
(pp. 1-4). IEEE. 


[17] Schiaffino, S., & Amandi, A. (2004). User-interface 
agent interaction: personalization issues. International 
Journal of Human-Computer Studies, 60(1), 129-148. 


[5] Chergui, M., Sayouti, A., & Medroumi, H. 


International Journal Of Engineering Sciences & 
Research Technology Multi-Agent Plateforme For 
Cobit Implementation. 

[6] C. McClean The Forrester Wave™: IT Governance, 
Risk, And Compliance Platforms, Q4 2011 Report 
December 2011. 

[7] Coraux, G. (2007). Infogerance: les risques du 
manage. L'Expansion Management Review, 127(4), 
119-129 

[8] Etzler, J. 2007. IT GOVERNANCE ACCORDING 

TO COBIT : How does the IT performance within 
one of the largest investment banks in the world 
compare to COBIT? 

2007_014.pdf (Accessed 10 July 2009). 

[9] Fimbel, E. (2001). L'externalisation des systemes 
d'information: les facteurs de succes (Doctoral 
dissertation, Reims). 

[10] Ives, B„ Hamilton, S„ & Davis, G. B. (1980). A 
framwork for research in computer-based 
management information systems. Management 
science, 26(9), 910-934. 

[11] Gruber, T. R. (1993). A translation approach to 
portable ontology specifications. Knowledge 
acquisition, 5(2), 199-220 

[12] Jiang, P. Mair, Q. and Newman, J. (2003) : Using 

uml to design distributed collaborative workflows: 
from uml to xpdl. In Proceedings of the Twelfth 
IEEE International Workshops on Enabling 
Technologies: Infrastructure for Collaborative 

Enterprises. 

[13] L. Northrop, P. Feiler, R. P. Gabriel, J. Goode -nough, 
R. Linger, T. Longstaff, R. Kazman, M. Klein,D. 
Schmidt, K. Sullivan, and K. Wallnau. Ultra-large- 
scale systems - the software challenge of the 
future. Technical report. Software Engineering 
Institute, Carnegie Mellon, June 2006. 

[14] Lieberman, H. (1997, March). Autonomous interface 
agents. In Proceedings of the ACM SIGCHI 
Conference on Human factors in computing systems 
(pp. 67-74). ACM. 

[15] Lambrinoudakis, C. Kokolakis, S. Karyda, M. 
Tsoumas, V. Gritzalis, D. and Katsikas, S. (2003): 
Electronic voting systems: security implications of 
the administrative workflow. In Proceedings of the 
14th International Workshop on Database and Expert 
Systems Applications. 

[16] Muehlberger, R. Orlowska, M.E. and Kiepuszewski, 
B. (1999) : Backward step: The right direction for 
production workflow systems. In Proceedings of the 
Australian Database Conference 


www.ijaers.com Page 1 147 


